BACNET-STACK · CVE-2026-62973 · Package
NO FIX YET · SEE WHAT TO DO
BACnet Stack is a C library for the BACnet building-automation protocol, and its readpropm client can be made to read past a global receive buffer. A malicious BACnet/IP peer that answers a ReadPropertyMultiple request with a malformed but structurally valid reply can trigger the over-read.
first public Jul 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only builds that include the readpropm BACnet client application are described as affected, and the peer must be a BACnet/IP device that the client sends a ReadPropertyMultiple request to. Systems that only use the library as a server, or that never run readpropm against untrusted networks, face a smaller exposure. Teams that embed the library in building-automation or embedded devices should check which builds ship readpropm.
Not affected if no-readpropm-built, trusted-network-only
Who cares bacnet-stack, building-automation, c, embedded
apps/readpropm client built from the bacnet-stack source in your tree or firmware.1.4.5, 1.5.1, or 1.6.0 (fixed versions per the advisory, matching each release line).BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.